Skip to main content
Do this when an agent should act inside your own product (read an order, post into a chat, import a sheet) and the tool must know which task, workspace and end user the call is for. AgentArea signs that context per call; your server verifies it and can stream progress back into the task. Use Connect a remote MCP server instead for a third-party server that does not need to know who a call is for.

Prerequisites

  • An API key for the workspace. Only an API key (or a client-credentials token) may set metadata and end_user_id on a task.
  • An MCP server over Streamable HTTP that verifies the tool call context. @agentarea/tools does this for TypeScript; any server can follow the reference.
  • Two different random values: a static credential, and a signing secret of at least 32 characters.

Steps

1

Serve the tools

With @agentarea/tools, give the server both values and the instance id it will be registered under (audience). Until you know the id, start with audience unset and add it after the next step.
2

Connect it with a signing secret

context_secret is write-only: it goes to the secret manager and is never sent to the server or returned.
Set the returned id as the server’s audience. To add or rotate the secret on an existing instance, PATCH .../mcp-server-instances/{instance_id} with {"context_secret": "..."}; null removes it.
3

Attach the server to an agent

Attach the instance like any other MCP server, in the agent’s tools.
4

Start tasks with the end user and metadata

Every tool call of this task reaches your server with agentarea/end_user_id and agentarea/metadata, signed. The model can neither read them from its arguments nor change them.

Verify

Stream the task and look for progress and the structured result:
You see one tool.progress per notification (at most two a second per call) and a tool.result whose data.structured_content is {"rows": 23}. On the server, ctx.signed is true.

Troubleshooting

Either the static credential is wrong, or the context token was refused: a different secret on each side, audience set to something other than the instance id, or issuer other than agentarea. The server’s log names the failing check.
The instance has no context_secret, so AgentArea sends no context. Read the instance: json_spec.context_signing must be true.
The task was created from a signed-in browser session. Create it with an API key.
Private and cluster-internal addresses are refused unless the operator lists them in AGENTAREA_HTTP_PRIVATE_ALLOWLIST on the API and the worker, for example orders.apps.svc.cluster.local or 10.0.4.17/32. There is no per-workspace switch: whoever can create an instance could otherwise reach every internal service.

MCP tool call context

Every key, claim, rejection and limit

Stream task events

Read tool.progress and tool.result live
Last modified on October 13, 2026